AIKIDO-2026-239597

TL;DR

Special:RefreshEmbedVideoMetadata declares the embedvideo-refreshmetadata right but never checks it at request time, so any visitor who can reach the page, including anonymous users on a public wiki, can trigger a metadata refresh on a local audio or video file. The special page overrides execute() and calls neither parent::execute() nor checkPermissions()/authorizeAction(), and no other code in the request path performs a permission check. Hiding the action tab in EmbedVideoHooks only removes the UI link; the page's canonical name and URL remain publicly reachable. The fix adds a getRestriction() lookup and calls checkPermissions() before the special page processes a refresh request.